CVE-2026-46383
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Microsoft APM prior to 0.13.0 contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on Python 3.10 and 3.11. When a local .tar.gz is not recognized as a plugin-format bundle, APM extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... The vulnerability is fixed in 0.13.0.
Risk Assessment
A malicious archive could write files outside the intended directory on Windows, potentially leading to file overwrite or code execution. The risk affects users installing untrusted bundles on Python 3.10 or 3.11.
Recommendation
Upgrade Microsoft APM to version 0.13.0 or later. Avoid installing untrusted .tar.gz files via apm install until the upgrade is applied.
Other vulnerabilities in Microsoft APM
See all- CVE-2026-45539High
In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.
- CVE-2026-44641High
Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.
Original NVD description (English source)
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS